Privacy Policy

1. Who is responsible for your data

The data controller is Carlos Eduardo Sepúlveda Rojas, trading as Ecoturismo Tres Puntas, Carrer de Ramón y Cajal 97, 08024 Barcelona, Spain. Email: ecoturismotrespuntas.es@gmail.com. Phone and WhatsApp: +34 643 441 876.

2. What data we collect

• Contact details: your name, email address, phone number and country, when you write to us by email or WhatsApp, or when you book.
• Booking details: the tour, dates, number of travellers, pickup location (usually your hotel), and anything you tell us about dietary needs, mobility or health that matters for the tour.
• Payment information: payments are processed by our booking system and its payment providers. We do not see or store your full card details.
• Messages: the content of your conversations with us.
• Technical data: information about your device and how you use the website, such as pages visited, clicks, scrolling and mouse movements, collected through cookies and similar tools only where you allow it.

3. Why we use your data and on what legal basis

• To answer your questions and prepare a quote: steps taken at your request before a contract (Art. 6(1)(b) GDPR).
• To manage your booking, arrange transport and guides, and keep in touch before and during your tour: performance of the contract (Art. 6(1)(b) GDPR).
• To keep invoices and accounting records: compliance with our legal obligations (Art. 6(1)(c) GDPR).
• To take care of health or mobility needs you share with us: your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time.
• To send you news or offers: only with your consent. You can unsubscribe at any time.
• To understand how the website is used and improve it: your consent, given through the cookie banner.

We do not sell your personal data and we do not use it for automated decision-making or profiling.

4. Who we share it with

We only share your data when it is needed to run your trip or this website:

• Bókun, our booking and payment platform, and the payment providers it works with.
• Local guides, drivers and activity partners in Spain and Chile who run parts of your tour.
• Framer, which hosts this website.
• Microsoft, through Microsoft Clarity, which we use to understand how visitors use the website. Clarity only runs if you accept analytics cookies.
• Google (Gmail) and WhatsApp (Meta), which we use to communicate with you.
• Public authorities, when the law requires it.

These providers process data on our behalf or as independent controllers under their own privacy terms.

5. International transfers

Some of our providers are based outside the European Economic Area, for example in the United States, and our Atacama tours take place in Chile. When your data leaves the EEA, we rely on European Commission adequacy decisions or standard contractual clauses. For tours in Chile, sharing your details with our local team is necessary to carry out your booking (Art. 49(1)(b) GDPR).

6. How long we keep it

• Booking and invoicing data: for as long as Spanish tax and commercial law requires, generally up to six years.
• Enquiries that do not become a booking: up to 12 months.
• Marketing consent: until you withdraw it.
• Website analytics from Microsoft Clarity: kept by Microsoft under its own retention rules, for up to 13 months.
• Health or mobility information: deleted once your tour has ended.

7. Your rights

You can ask us to access, correct or delete your data, to restrict or object to its use, or to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time without affecting earlier processing. Write to ecoturismotrespuntas.es@gmail.com and we will reply within one month.

If you believe we have not handled your data properly, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

8. Cookies

This website uses the cookies it needs to work. With your consent, we also use Microsoft Clarity, an analytics tool that uses cookies to create heatmaps and session recordings of how visitors click, scroll and move through pages. Clarity masks text you type into forms, and we use what it collects only to improve the website. Analytics and marketing cookies are only used if you accept them. You can change your choice at any time through the Cookie Settings link at the bottom of every page. You can read more about how Microsoft handles this data at privacy.microsoft.com.

9. Children

Children are welcome on our tours, but bookings must be made by an adult. We only process a child’s data, such as name and age, when a parent or guardian gives it to us for the booking.

10. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last changed.